Prevent Accidental DNS Zone Deletion in Automated Pipelines — Destructive Operation Guard

Описание и применение

Автоматизированные пайплайны могут случайно удалять DNS‑зоны, что приводит к потере данных. В статье предлагается использовать список разрешенных зон, логировать намерения и выполнять только удаление отдельных записей по умолчанию, а удаление зоны разрешать только после явного одобрения.

Задача

Automated pipelines can unintentionally delete entire DNS zones, causing irreversible loss of records and costly recovery.

Результат

The pipeline now safely deletes only intended records, requires human approval for zone deletes, and retains audit evidence for reconstruction, reducing accidental data loss and recovery costs.

Рабочий процесс

• 1. Configure pipeline to delete only specific record identifiers or names by default.
• 2. Add an allowlist of approved domain identifiers with expiry tokens for destructive zone deletes.
• 3. Before performing a delete, log intent to a central audit service (e.g., Infrai logs).
• 4. If the operation is a zone delete, verify the domain is present in the allowlist and the token is valid.
• 5. Execute the DNS record delete via the provider API; if the domain is not approved, raise an explicit exception.
• 6. Store audit logs and record snapshots for potential reconstruction.
• 7. Review audit logs periodically to ensure compliance and detect misuse.

Доказательства

require an explicit allowlist for destructive DNS operations, and make automation perform record-level deletes by default

Источник

The example below defaults to record deletion, logs intent before the destructive call, and refuses a domain delete unless the caller supplies an exact approved domain

Источник